Biblio

Face capturing is a task to capture and store the "best" face of each person passing by the monitor. To some extent, it is similar to face tracking, but uses a different criterion and requires a valuable (i.e., high-quality and recognizable) face selection procedure. Face capturing systems play a critical role in public security. When deployed on edge devices, it is capable of reducing redundant storage in data center and speeding up retrieval of a certain person. However, high computation complexity and high repetition rate caused by ID switch errors are major challenges. In this paper, we propose a novel solution to constructing a real-time low-repetition face capturing system on chips. First, we propose a two-stage association algorithm for memory-efficient and accurate face tracking. Second, we propose a fast and reliable face quality estimation algorithm for valuable face selection. Our pipeline runs at over 20fps on Hisiv 3559A SoC with a single NNIE device for neural network inference, while achieving over 95% recall and less than 0.4 repetition rate in real world surveillance videos.

Information-Centric Networking (ICN) is attracting attention as a content distribution method against increasing network traffic. Content distribution in ICN adopts a pull-type communication method that returns data to Interest. However, in this case, the push-type communication method is advantageous. Therefore, the authors have proposed a method in which a server pushes content to reduce the node load in an environment where a large amount of Interest to specific content occurs in a short time. In this paper, we analyze the packet processing delay time with and without the proposed method in an environment where a router processes a large number of packets using a simulator. Simulation results show that the proposed method can reduce packet processing delay time and node load.

The paper is devoted to the development and research of the redundancy cyber resiliency technique based on fast rerouting under security metric with the implementation of the basic schemes for network elements protection, namely node, link, path, and bandwidth. Within the model, the secure fast rerouting task is formulated as an optimization problem of nonlinear programming. The model is configured in order to calculate primary and backup paths that contain links with the minimum values of the probability of compromise that is achieved by using the appropriate weights in the objective function, the value of which is minimized. Numerical research has been conducted, results of which proved the proposed model efficiency and adequacy for the practical application.

The internal structure of the flexible-DC transformer is complicated and the lack of a reliable vibration calculation model limits the application of the vibration analysis method in the fault diagnosis of the flexible-DC transformer. In response to this problem, this paper analyzes the correlation between the vibration signals of multiple measuring points and establishes a ``black box'' model of transformer vibration detection. Using the correlation analysis of multiple measuring points and BP neural network, a ``black box'' model that simulates the internal vibration transmission relationship of the transformer is established. The vibration signal of the multiple measuring points can be used to calculate the vibration signal of the target measuring point under specific working conditions. This can provide effective information for fault diagnosis and judgment of the running status of the flexible-DC transformer.

Cloud computing is applied in various domains, among which social recommender systems are well-received because of their effectivity to provide suggestions for users. Social recommender systems perform well in alleviating cold start problem, but it suffers from shilling attack due to its natural openness. Shilling attack is an injection attack mainly acting on the training process of machine learning, which aims to advance or suppress the recommendation ranking of target items. Some researchers have studied the influence of shilling attacks in two perspectives simultaneously, which are user-item's rating and user-user's relation. However, they take more consideration into user-item's rating, and up to now, the construction of user-user's relation has not been explored in depth. To explore shilling attacks with complex relations, in this paper, we propose two novel attack models based on triangle relations in social networks. Furthermore, we explore the influence of these models on five social recommendation algorithms. The experimental results on three datasets show that the recommendation can be affected by the triangle relation attacks. The attack model combined with triangle relation has a better attack effect than the model only based on rating injection and the model combined with random relation. Besides, we compare the functions of triangle relations in friend recommendation and product recommendation.

Container technology has been used for running multiple isolated operating system distros on a host or deploying large scale microservice-based applications. In most cases, containers share the same kernel with the host and other containers on the same host, and the application in the container can make system calls of the host kernel like a normal process on the host. Seccomp is a security mechanism for the Linux kernel, through which we can prohibit certain system calls from being executed by the program. Docker began to support the seccomp mechanism from version 1.10 and disables around 44 system calls out of 300+ by default. However, for a particular container, there are still many system calls that are unnecessary for running it allowed to be executed, and the abuse of system calls by a compromised container can trigger the security vulnerabilities of a host kernel. Unfortunately, Docker does not provide a way to get the necessary system calls for a particular container. In this paper, we propose RSDS, a method combining dynamic analysis and static analysis to get the necessary system calls for a particular container. Our experiments show that our solution can reduce system calls by 69.27%-85.89% compared to the default configuration on an x86-64 PC with Ubuntu 16.04 host OS and does not affect the functionalities of these containers.

Modern learning systems, say a tutoring platform, has many characteristics like digital data presentation with interactivity, mobility, which provides information about the study-content as per the learners understanding levels, intelligent learners behavior, etc. A sophisticated ubiquitous learner system maintains security and monitors the mischievous behavior of the learner, and authenticates and authorizes every learner, which is quintessential. Some of the existing security schemes aim only at single entry-point authentication, which may not suit to ubiquitous tutor platform. We propose a secured authentication scheme which is based on the information utility of the learner. Whenever a learner moves into a tutor platform, which has ubiquitous learner system technology, the system at first-begins with learners' identity authentication, and then it initiates trust evaluation after the successful authentication of the learner. Periodic credential verification of the learner will be carried out, which intensifies the authentication scheme of the system proposed. BAN logic has been used to prove the authentication in this system. The proposed authentication scheme has been simulated and analyzed for the indoor tutor platform environment.

Industry is increasingly adopting Reinforcement Learning algorithms (RL) in production without thoroughly analyzing their security features. In addition to the potential threats that may arise if the functionality of these algorithms is compromised while in operation. One of the well-known RL algorithms is the Contextual Multi-Armed Bandit (CMAB) algorithm. In this paper, we explore how the CMAB can be used to solve the Link Adaptation problem - a well-known problem in the telecommunication industry by learning the optimal transmission parameters that will maximize a communication link's throughput. We analyze the potential vulnerabilities of the algorithm and how they may adversely affect link parameters computation. Additionally, we present a provable security assessment for the Contextual Multi-Armed Bandit Reinforcement Learning (CMAB-RL) algorithm in a network simulated environment using Ray. This is by demonstrating CMAB security vulnerabilities theoretically and practically. Some security controls are proposed for CMAB agent and the surrounding environment. In order to fix those vulnerabilities and mitigate the risk. These controls can be applied to other RL agents in order to design more robust and secure RL agents.

Ubiquitous Electric Internet of Things (UEIoT) is the next generation electrical energy networks. The distributed and open structure of UEIoT is weak and vulnerable to security threats. To solve the security problem of UEIoT terminal, in this paper, the interaction between smart terminals and the malicious attackers in UEIoT as a differential game is investigated. A complex decision-making process and interactions between the smart terminal and attackers are analyzed. Through derivation and analysis of the model, an algorithm for the optimal defense strategy of UEIoT is designed. The results lay a theoretical foundation, which can support UEIoT make a dynamic strategy to improve the defensive ability.

Wireless Network-on-Chip (WNoC) broadly adopts single channel for low overhead data transmission. Sharing of the channel among multiple wireless interfaces (WIs) is controlled by a channel access mechanism (CAM). Such CAM can be malfunctioned by a Hardware Trojan (HT) in a malicious WI or a rogue third party intellectual property (IP) core present on the same System-on-Chip (SoC). This may result in denial-of-service (DoS) or spoofing in WNoC leading to starvation of healthy WIs and under-utilization of wireless channel. Our work demonstrates possible threat model on CAM and proposes low overhead decentralized countermeasures for both DoS and spoofing attacks in WNoC.

Multicast on-chip communication is encountered in various cache-coherence protocols targeting multi-core processors, and its pervasiveness is increasing due to the proliferation of machine learning accelerators. In-network handling of multicast traffic imposes additional switching-level restrictions to guarantee deadlock freedom, while it stresses the allocation efficiency of Network-on-Chip (NoC) routers. In this work, we propose a novel NoC router microarchitecture, called SmartFork, which employs a versatile and cost-efficient multicast packet replication scheme that allows the design of high-throughput and low-cost NoCs. The design is adapted to the average branch splitting observed in real-world multicast routing algorithms. Compared to state-of-the-art NoC multicast approaches, SmartFork is demonstrated to yield higher performance in terms of latency and throughput, while still offering a cost-effective implementation.

Fifth-generation (5G) network demands of higher data rate, massive user connectivity and large spectrum can be achieve using Sparse Code Multiple Access (SCMA) scheme. The integration of cognitive feature spectrum sensing with SCMA can enhance the spectrum efficiency in a heavily dense 5G wireless network. In this paper, we have investigated the primary user detection performance using SCMA in Centralized Cooperative Spectrum Sensing (CCSS). The developed model can support massive user connectivity, lower latency and higher spectrum utilization for future 5G networks. The simulation study is performed for AWGN and Rayleigh fading channel. Log-MPA iterative receiver based Log-Likelihood Ratio (LLR) soft test statistic is passed to Fusion Center (FC). The Wald-hypothesis test is used at FC to finalize the PU decision.

Public-key cryptography is a ubiquitous buildingblock of modern telecommunication technology. Among the most historically important, the knapsack-based encryption schemes, from the early years of public-key cryptography, performed particularly well in computational resources (time and memory), and mathematical and algorithmic simplicity. Although effective cryptanalyses readily curtailed their widespread adoption to several different attempts, the possibility of actual usage of knapsack-based asymmetric encryption schemes remains unsettled. This paper aims to present a novel construction that offers consistent security improvements on knapsack-based cryptography. We propose two improvements upon the original knapsack cryptosystem that address the most important types of attacks: the Diophantine approximationsbased attacks and the lattice problems oracle attacks. The proposed defences demonstrably preclude the types of attacks mentioned above, thus contributing to revive knapsack schemes or settle the matter negatively. Finally, we present the http://t3infosecurity.com/nepsecNep.Sec, a contest that is offering a prize for breaking our proposed cryptosystem.

With the deployment of artificial intelligent (AI) algorithms in a large variety of applications, there creates an increasing need for high-performance computing capabilities. As a result, different hardware platforms have been utilized for acceleration purposes. Among these hardware-based accelerators, the field-programmable gate arrays (FPGAs) have gained a lot of attention due to their re-programmable characteristics, which provide customized control logic and computing operators. For example, FPGAs have recently been adopted for on-demand cloud services by the leading cloud providers like Amazon and Microsoft, providing acceleration for various compute-intensive tasks. While the co-residency of multiple tenants on a cloud FPGA chip increases the efficiency of resource utilization, it also creates unique attack surfaces that are under-explored. In this paper, we exploit the vulnerability associated with the shared power distribution network on cloud FPGAs. We present a stealthy power attack that can be remotely launched by a malicious tenant, shutting down the entire chip and resulting in denial-of-service for other co-located benign tenants. Specifically, we propose stealthy-shutdown: a well-timed power attack that can be implemented in two steps: (1) an attacker monitors the realtime FPGA power-consumption detected by ring-oscillator-based voltage sensors, and (2) when capturing high power-consuming moments, i.e., the power consumption by other tenants is above a certain threshold, she/he injects a well-timed power load to shut down the FPGA system. Note that in the proposed attack strategy, the power load injected by the attacker only accounts for a small portion of the overall power consumption; therefore, such attack strategy remains stealthy to the cloud FPGA operator. We successfully implement and validate the proposed attack on three FPGA evaluation kits with running real-world applications. The proposed attack results in a stealthy-shutdown, demonstrating severe security concerns of co-tenancy on cloud FPGAs. We also offer two countermeasures that can mitigate such power attacks.

Medical institutions are increasingly adopting IoT platforms to share data, communicate rapidly and improve healthcare treatment abilities. However, this trend is also raising the risk of potential data manipulation attacks. In decentralized networks, defense mechanisms against external entities have been widely enabled while protection against insider attackers is still the weakest link of the chain. Most of the platforms are based on the assumption that all the insider nodes are trustworthy. However, these nodes are exploiting of this assumption to lead manipulation attacks and violate data integrity and reliability without being detected. To address this problem, we propose a secure decentralized management system able to detect insider malicious nodes. Our proposal is based on a three layer architecture: storage layer, blockchain based network layer and IoT devices layer. In this paper, we mainly focus on the network layer where we propose to integrate a decentralized trust based authorization module. This latter allows updating dynamically the nodes access rights by observing and evaluating their behavior. To this aim, we combine probabilistic modelling and stochastic modelling to classify and predict the nodes behavior. Conducted performance evaluation and security analysis show that our proposition provides efficient detection of malicious nodes compared to other trust based management approaches.

This paper presents a study and analysis of flux linkage performance on 12/8 pole doubly salient permanent magnet machine in square envelope conventional. Analyzed model was using a finite element method. The investigated model was constructed by changing the size of the structure as the main parameters of the speed 500 rpm, PM coercivity 910 kA/m, PM remanence 1.2 T, copper loss 30 W, turns per coil 45, and stator side length 100 mm. The study and analysis of flux linkage, induced voltage, and torque are also included in this paper.

An exceptional feature of the development of modern operating systems based on the Linux kernel is their leading use in cloud technologies, mobile devices and the Internet of things, which is accompanied by the emergence of more and more security threats at the kernel level. In order to improve the security of existing and future Linux distributions, it is necessary to analyze the existing approaches and tools for automated vulnerability detection and to conduct experimental security testing of some current versions of the kernel. The research is based on fuzzing - a software testing technique, which consists in the automated detection of implementation errors by sending deliberately incorrect data to the input of the fuzzer and analyzing the program's response at its output. Using the Syzkaller software tool, which implements a code coverage approach, vulnerabilities of the Linux kernel level were identified in stable versions used in modern distributions. The direction of this research is relevant and requires further development in order to detect zero-day vulnerabilities in new versions of the kernel, which is an important and necessary link in increasing the security of the Linux operating system family.

A physical protection system (PPS) integrates people, procedures, and equipment for the protection of assets or facilities against theft, sabotage, or other malevolent intruder attacks. In this paper we focus on the architecture modeling of PPS to support the communication among stakeholders, analysis and guiding the systems development activities. A common practice for modeling architecture is by using an architecture framework that defines a coherent set of viewpoints. Existing systems engineering modeling approaches appear to be too general and fail to address the domain-specific aspects of PPSs. On the other hand, no dedicated architecture framework approach has been provided yet to address the specific concerns of PPS. In this paper, we present an architecture framework for PPS (PPSAF) that has been developed in a real industrial context focusing on the development of multiple PPSs. The architecture framework consists of six coherent set of viewpoints including facility viewpoint, threats and vulnerabilities viewpoint, deterrence viewpoint, detection viewpoint, delay viewpoint, and response viewpoint. We illustrate the application of the architecture framework for the design of a PPS architecture of a building.

There are a lot of emerging security equipment required to be tested on detection rate (DR) and false alarm rate (FAR) for prohibited items. This article imports Bayesian approach to accept or reject DR and FAR. The detailed quantitative predictions can be made through the posterior distribution obtained by Markov chain Monte Carlo method. Based on this, HDI + ROPE decision rule is established. For the tests that need to make early decision, HDI + ROPE stopping rule is presented with biased estimate value, and criterial precision rule is presented with unbiased estimate value. Choosing the stopping rule according to the test purpose can achieve the balance of efficiency and accuracy.

As the world is moving towards industry 4.0, it is estimated that in the near future billions of IoT devices will be interconnected over the Internet. The open and heterogeneous nature of IoT environment makes it vulnerable to adversarial attacks. To maintain sustainability in IoT ecosystem, this paper evaluates some of the recent IoT schemes based on key security features i.e. authentication, confidentiality, trust etc. These schemes are classified according to three-layer IoT architecture. Based on our findings, some of these solutions are applicable at physical layer while others are at network, and application layers. However, none of these schemes can provide end-to-end solution for IoT environment. Therefore, our work provides a roadmap for future research directions in IoT domain to design robust security schemes for IoT environment, thus can achieve sustainability in IoT ecosystem.

Information level protection standard 2.0 requires trusted verification of system bootstrappers, system programs, etc. of server equipment based on trusted root. According to the requirements of information level protection standard, this paper puts forward a network trusted start-up scheme based on the trusted platform control module to guarantee the security and trust of the server's BIOS firmware, PXE boot file and Linux system file. When publishing BIOS firmware, PXE startup file, Linux system file, the state-secret algorithm SM3 is used to calculate the summary value as the benchmark value, and stored in the trusted platform control module, BIOS firmware, Linux boot file. When the server starts up with PXE, the BIOS firmware is measured by the Trusted Platform Control Module, the BIOS Start Environment Measures PXE Boot File, and the PXE Boot File measures the Linux system file. The trusted platform control module is the trust root level measurement level, the first level of trust level, the trust chain, the implementation of a trusted server operating environment. The method proposed in this paper is tested on the domestic autonomous controllable Sunway server, and the experimental results show that the method proposed in this paper is feasible.

Provable Data Possession (PDP) is one of the data security techniques to make sure that the data stored in the cloud storage exists. In PDP, the integrity of the data stored in the cloud storage is probabilistically verified by the user or a third-party auditor. In the conventional PDP, the user creates the metadata used for audition. From the viewpoint of user convenience, it is desirable to be able to audit without operations other than uploading. In other words, the challenge is to provide a transparent PDP that verifies the integrity of files according to the general cloud storage system model so as not to add operations to users. We propose a scheme in which the cloud generates the metadata used during verification, and the user only uploads files. It is shown that the proposed scheme is resistant to the forgery of cloud proof and the acquisition of data by a third-party auditor.

The exceptional attributes of impromptu network of being framework less, self-composed and unconstrained make the task more challenging to secure it. In mobile Ad-hoc network nodes reliant on one another for transmitting information, that make MANET helpless against different sorts of security attacks. These security attacks can be arranged as Passive and Active attacks. Wormhole is an Active attack and considered generally risky as it can make significant harm routing. Various secure routing mechanism has been created are based on cryptography mechanism, need pre-organized structure, centralized authority, or need external hardware, etc. These components are unreasonable due to restricted accessible assets in MANET. In this paper, we are proposing an effective trust-based mechanism based on the concept of Node to Node packet delay for the detection of the malevolent node of wormhole. The trust value of each node is calculated by observing the packet transaction among adjacent nodes and later this trust value is used for identification of malevolent node. Based on the trust values, further routing decisions and selecting a secured route can be perform.

In modern internet-scale computing, interaction between a large number of parties that are not known a-priori is predominant, with each party functioning both as a provider and consumer of services and information. In such an environment, traditional access control mechanisms face considerable limitations, since granting appropriate authorizations to each distinct party is infeasible both due to the high number of grantees and the dynamic nature of interactions. Trust management has emerged as a solution to this issue, offering aids towards the automated verification of actions against security policies. In this paper, we present a trust- and risk-based approach to security, which considers status, behavior and associated risk aspects in the trust computation process, while additionally it captures user-to-user trust relationships which are propagated to the device level, through user-to-device ownership links.

Today, authentication and non-repudiation of actions are essential requirements for almost all mobile services. In this respect, various common identity systems (such as Facebook Login, Google Sign-In, Apple ID and many other) based on OpenID Connect protocol have been introduced that support easier password management for users, and reduce potential risks by securing the service provider and the user. With the widespread use of the Internet, smartphones can offer many services with rich content. The use of common identity systems on mobile devices with a high security level is becoming a more important requirement. At this point, MNOs (Mobile Network Operators) have a significant potential and capability for providing common identity services. The existing solutions based on Mobile Connect standard provide generally low level of assurance. Accordingly, there is an urgent need for a common identity system that provide higher level of assurance and security for service providers. This study presents a multi-factor authentication mechanism called TrustedID system that is based on Mobile Connect and OpenID Connect standards, and ensures higher level of assurance. The proposed system aims to use three identity factors of the user in order to access sensitive mobile services on the smartphone. The proposed authentication system will support improvement of new value-added services and also support the development of mobile ecosystem.